Privacy Policy

Effective date: August 26, 2026

Last Updated: August 26, 2026

This Privacy Policy explains how DataSheets Pro LLC (“DataSheets Pro,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information when you access or use our websites, applications, document-building tools, demos, integrations, and related services (collectively, the “Service”).

For purposes of this Privacy Policy, “personal information” includes information that identifies, relates to, describes, or can reasonably be linked to an individual, including “personal data” where that term is used under applicable privacy laws.

1. Scope and Definitions

DataSheets Pro provides software for creating, managing, organizing, reusing, and exporting product and business documentation.

This Privacy Policy applies to personal information we process in connection with:

• our websites;
• DataSheets Pro accounts and workspaces;
• subscriptions and billing;
• customer support;
• product usage and analytics;
• imports and document-processing features;
• AI-assisted and automated features;
• integrations;
• demos;
• communications; and
• related business operations.

This Privacy Policy does not apply to third-party websites, products, or services that we do not control.

For purposes of this Privacy Policy:

• “Customer” means the individual or organization that creates, purchases, owns, or controls a DataSheets Pro workspace.
• “Authorized User” means an employee, contractor, agent, or other person whom a Customer permits to access its workspace.
• “Customer Content” means documents, data, product information, specifications, tables, images, logos, brand assets, files, spreadsheets, source materials, custom templates, text, generated exports, and other materials that a Customer or Authorized User uploads, enters, imports, creates, or stores through the Service.
• “Customer Personal Data” means personal information contained in Customer Content that DataSheets Pro processes on behalf of a Customer.
• “Service Usage Data” means technical, operational, analytics, performance, and interaction data generated through use of the Service, excluding Customer Content itself.

Capitalized terms not defined in this Privacy Policy have the meanings given in our Terms of Service.

2. Our Role as Controller and Processor

DataSheets Pro may process personal information in different roles depending on the context.

When DataSheets Pro determines how information is used

DataSheets Pro generally determines the purposes and means of processing information relating to:

• account registration;
• authentication;
• subscriptions and billing;
• website visitors;
• product analytics;
• security and fraud prevention;
• customer support;
• service communications;
• business communications; and
• our own legal and operational obligations.

In these circumstances, DataSheets Pro generally acts as the business, controller, or equivalent responsible entity under applicable privacy law.

When we process Customer Personal Data for a Customer

Business Customers may upload, create, import, or otherwise process personal information through Customer Content.

For example, Customer Content may contain:

• employee names;
• contact information;
• revision-owner information;
• approver information;
• supplier or customer contacts;
• signatures;
• document metadata; or
• other information relating to individuals.

When DataSheets Pro processes Customer Personal Data on behalf of a Customer and according to that Customer’s instructions, the Customer generally determines why the information is processed and DataSheets Pro acts as its processor, service provider, contractor, or equivalent.

Our processing of Customer Personal Data may also be governed by our Terms of Service, an applicable order form, or a Data Processing Addendum available to business Customers upon request or where required by applicable law.

If your personal information appears in Customer Content controlled by one of our Customers, privacy requests concerning that information may need to be directed to that Customer. We will assist Customers with qualifying privacy requests as required by applicable law and our agreements.

3. Personal Information We Collect

We collect personal information in several ways.

Information you provide directly

Account and authentication information

When you create or use an account, we may collect:

• name;
• email address;
• organization or company name;
• account identifiers;
• authentication identifiers;
• profile image;
• role;
• preferences; and
• account settings.

Where authentication is handled by an authentication provider, DataSheets Pro does not receive plaintext passwords.

Workspace and team information

When you create, join, or administer a workspace, we may collect:

• workspace name;
• organization information;
• team membership;
• user roles;
• permissions;
• invitations;
• administrator information;
• user assignments;
• workspace preferences; and
• brand or account settings.

Customer Content

We process information contained in materials you create, upload, import, store, or manage through the Service, including:

• product documents;
• specifications;
• spreadsheets;
• CSV files;
• PDFs;
• text;
• technical information;
• tables;
• images;
• logos;
• brand kits;
• custom fields;
• templates;
• document metadata;
• version information;
• generated exports (PDF and image files);
• links between products and documents; and
• other files or content.

Customer Content may contain personal information depending on what a Customer chooses to include.

Imported and source information

If you use import, mapping, extraction, synchronization, relationship, or related-document features, we process information contained in the files or sources you provide.

AI-assisted feature information

If you use AI-assisted or automated features, we may process:

• prompts;
• instructions;
• documents;
• files;
• selected Customer Content;
• source data;
• AI inputs;
• generated responses; and
• other information necessary to provide the requested feature.

Billing and subscription information

When you purchase or manage a subscription, we may collect:

• billing name;
• billing contact information;
• billing address;
• plan information;
• user quantities;
• subscription status;
• invoice information;
• transaction identifiers;
• payment status; and
• limited payment-method information returned by our payment processor.

Full payment-card numbers are collected and processed directly by our payment provider and are not received or stored by DataSheets Pro.

Communications

We collect information you provide when you:

• contact support;
• report a problem;
• submit feedback;
• respond to surveys;
• communicate with us by email; or
• otherwise contact DataSheets Pro.

Information collected automatically

Usage information

We may collect information such as:

• pages visited;
• features used;
• workflow interactions;
• actions taken;
• usage frequency;
• session activity; and
• feature adoption.

Device and technical information

We may collect:

• IP address;
• browser type;
• operating system;
• device type;
• referring page;
• page URL;
• timestamps;
• session identifiers;
• language;
• approximate region derived from IP address;
• performance information; and
• diagnostic information.

Security and log information

We may collect:

• login activity;
• authentication events;
• IP addresses;
• security events;
• failed login attempts;
• administrative actions;
• error logs; and
• information used to identify fraud, abuse, or suspicious activity.

Demo experience

We may provide a no-signup or public demonstration of DataSheets Pro.

When you use a demo, we may collect:

• IP address;
• browser and device information;
• temporary session identifiers;
• security and diagnostic logs;
• basic usage information; and
• information you type, create, or, where supported, upload within the demo.

Demo content is temporary and is not treated as persistent Customer Content.

Demo documents and any supported demo uploads are retained only for the duration necessary to operate the applicable demo session and are deleted when the demo session expires, is reset, or is otherwise cleared.

If you later create an account, demo content does not automatically become Customer Content unless you expressly choose to save, transfer, or recreate that information within your account.

You should not enter or upload confidential, regulated, sensitive, or production-critical information into a public demo.

Demo PDF rendering

When you request a watermarked PDF export from the demo, the content needed to create that export is transmitted to DataSheets Pro infrastructure for server-side rendering.

We do not retain the rendered demo content or generated demo PDF after the export has been returned to your browser, except for temporary technical processing necessary to complete the request.

4. Sources of Personal Information

We may obtain personal information:

• Directly from you, such as when you create an account, upload content, subscribe, use a demo, or contact support.
• From your organization or workspace administrator, such as when an employer invites you to a workspace or assigns permissions.
• Automatically from your use of the Service, including through logs, analytics, security systems, and necessary technical storage.
• From service providers, such as payment, authentication, communications, or support providers.
• From third-party integrations you authorize, where the Service permits you to connect another system or data source.
• From Customers, where personal information about another individual is included in Customer Content.

5. How We Use Personal Information

We use personal information for the following purposes.

Provide and operate the Service

Including to:

• create and maintain accounts;
• authenticate users;
• operate workspaces;
• store and display Customer Content;
• create previews and exports;
• process imports;
• perform mappings;
• support relationships between products and documents;
• provide collaboration features; and
• deliver requested functionality.

Administer subscriptions

Including to:

• process payments;
• manage subscriptions;
• manage users and account entitlements;
• issue invoices;
• process upgrades or downgrades;
• manage failed payments; and
• maintain billing records.

Provide support

Including to:

• respond to questions;
• investigate problems;
• troubleshoot issues;
• communicate about support requests; and
• improve support services.

Maintain security and prevent abuse

Including to:

• authenticate users;
• prevent fraud;
• detect suspicious activity;
• enforce permissions;
• prevent misuse;
• investigate security incidents; and
• protect Customers, DataSheets Pro, and others.

Improve and develop the Service

Including to:

• understand feature usage;
• identify usability issues;
• measure performance;
• analyze product adoption;
• troubleshoot errors;
• develop new features; and
• improve existing functionality.

Provide AI-assisted functionality

When you choose to use an AI-assisted or automated feature, we process the information necessary to provide the requested functionality.

Communicate with you

We may send service-related communications such as:

• account notices;
• authentication messages;
• security alerts;
• billing notices;
• legal notices;
• support communications; and
• material Service updates.

You may not be able to opt out of communications necessary to provide, secure, or administer an active account.

Where permitted by law, we may also send marketing or promotional communications.

You may opt out of marketing emails at any time by using the unsubscribe link included in the message or another opt-out method we provide.

Opting out of marketing communications does not opt you out of essential service-related communications.

Comply with legal obligations

Including to:

• comply with tax and accounting requirements;
• respond to lawful requests;
• resolve disputes;
• enforce agreements;
• protect legal rights; and
• comply with applicable laws and regulations.

6. Legal Bases for Processing

Where privacy law requires us to identify a legal basis for processing, we rely on one or more of the following.

Performance of a contract

We process information where necessary to:

• provide the Service;
• create and administer accounts;
• operate subscriptions;
• provide requested features; and
• fulfill contractual obligations.

Legitimate interests

We may process information where necessary for legitimate business interests, including:

• securing the Service;
• preventing fraud;
• improving product functionality;
• providing support;
• understanding product usage;
• maintaining business operations; and
• protecting legal rights.

When relying on legitimate interests, we consider the impact on individuals and their privacy rights.

Legal obligations

We process information where necessary to comply with applicable legal, tax, accounting, regulatory, or law-enforcement obligations.

Consent

We rely on consent where required, including for certain:

• marketing communications;
• optional processing activities;
• non-essential technologies, if introduced; or
• other uses where applicable law requires consent.

Where processing is based on consent, you may withdraw that consent at any time, subject to applicable law.

7. Customer Content and Workspace Data

Customers retain rights in their Customer Content as described in our Terms of Service.

We access and process Customer Content only as reasonably necessary to:

• provide the Service;
• perform requested features;
• provide support;
• maintain security;
• prevent abuse;
• maintain backups and disaster recovery;
• comply with law; or
• act on the Customer’s instructions.

Workspace visibility

Customer Content and activity may be visible to other Authorized Users according to workspace roles and permissions.

Workspace administrators may have broader access and may be able to:

• access Customer Content;
• manage users;
• assign roles;
• transfer documents;
• change permissions;
• export content; or
• delete content.

Leaving or being removed from a workspace

Customer Content created within an organization workspace remains associated with that workspace when an Authorized User leaves or is removed.

Removing a user from a workspace does not automatically delete that user’s DataSheets Pro account or information associated with other workspaces.

If you use DataSheets Pro through an employer or other organization, that organization may continue to control Customer Content associated with its workspace after you leave.

8. AI-Assisted and Automated Features

DataSheets Pro may offer AI-assisted or automated features for tasks such as:

• document analysis;
• field mapping;
• extraction;
• classification;
• summarization;
• recommendations;
• content assistance; or
• other automated processing.

When you use these features, Customer Content or other inputs may be sent to AI or automated-processing subprocessors acting on our behalf.

We use such information only as necessary to provide the functionality requested by the Customer and for related security, reliability, and support purposes.

AI model training

We do not use Customer Content to train AI models.

We contractually require AI subprocessors acting on our behalf not to use Customer Content to train their AI models.

If we ever offer an optional program that would use Customer Content for model training or similar improvement, participation will require separate affirmative Customer consent or agreement.

We do not currently use any AI provider to process Customer Content. If we introduce AI-assisted features, any provider that would process Customer Content will be added to our Subprocessor List before it does so.

9. Service Usage Data, Analytics, and De-Identified Information

We may collect Service Usage Data to:

• operate the Service;
• measure performance;
• troubleshoot issues;
• maintain security;
• understand how features are used;
• improve usability;
• evaluate product adoption; and
• develop new functionality.

We may use aggregated or de-identified information for:

• analytics;
• benchmarking;
• research;
• product development; and
• business planning,

provided that the information does not reasonably identify a Customer, Authorized User, or underlying Customer Content.

Where we maintain information in de-identified form, we do not attempt to re-identify it except where permitted by law to test or validate whether our de-identification processes are effective.

De-identified information is not treated as Customer Content where it cannot reasonably be used to identify the Customer, user, or underlying Customer Content.

Viewers of shared data sheets

Customers can publish a document to a public web link and share it with their own customers. When someone opens a shared link or downloads its PDF, we count the visit so the Customer who published it can see how the link is used. For each visit we record the date and time, whether it was a page view or a PDF download, the country (derived from the IP address by our hosting provider), the domain of the referring website (not the full address), the kind of device (desktop, mobile or tablet), and how the link was reached (for example, a printed QR code).

To count unique visitors without cookies, we combine the IP address and browser details with a random value that we delete after one day and store only the result. We do not store IP addresses, set cookies, or use any other storage on the visitor's device for this, and shared pages load no advertising or third-party analytics scripts. We do not count a visit when the browser sends a Do Not Track or Global Privacy Control signal, and the Customer's own signed-in team members are not counted. Individual visit records are deleted after 90 days.

On some plans, the Customer can instead send a person their own personal link, labelled with a name the Customer chooses. Visits through a personal link are recorded in the same way and are also reported to the Customer against that label, so the Customer can see when that person opened the page or downloaded the PDF. A personal link's page says so at the top. We store only the Customer's label, not the recipient's email address or other contact details, and the Customer can revoke the link at any time.

We process this information on behalf of the Customer who published the link, and on the basis of our and the Customer's legitimate interest in understanding how shared documents are used. Shared pages are not listed in search engines. To report a shared page, contact us.

10. How We Disclose Personal Information

We may disclose personal information in the following circumstances.

Service providers and subprocessors

We use service providers and subprocessors to help operate the Service.

Depending on the features used, these providers may support:

• cloud hosting;
• databases;
• file storage;
• authentication;
• payment processing;
• email and communications;
• analytics;
• error monitoring;
• customer support;
• security;
• AI processing; and
• other infrastructure or functionality.

Our current material subprocessors are identified on our Subprocessor List.

Changes to subprocessors

Where DataSheets Pro processes Customer Personal Data on behalf of a Customer and uses general authorization for subprocessors, we provide notice of intended additions or replacements of material subprocessors.

Our standard practice is to provide workspace administrators or other designated Customer contacts at least 30 days’ advance notice before a new material subprocessor begins processing Customer Personal Data, where reasonably practicable.

A Customer may raise a reasonable data-protection objection during that notice period.

The process for addressing qualifying objections may be further described in a Data Processing Addendum available to business Customers upon request or where required by applicable law.

Within a Customer workspace

Information may be disclosed to other Authorized Users or workspace administrators according to the Customer’s roles, permissions, and workspace settings.

Third-party integrations

If you choose to connect DataSheets Pro with a third-party product or integration, we may disclose information as necessary to provide that integration.

Third-party products may process information under their own terms and privacy policies.

Professional advisers

We may disclose information where reasonably necessary to:

• attorneys;
• accountants;
• auditors;
• insurers;
• consultants; and
• other professional advisers,

subject to appropriate confidentiality obligations.

Legal and safety reasons

We may disclose information if we reasonably believe disclosure is necessary to:

• comply with law;
• respond to a subpoena, court order, or lawful governmental request;
• enforce our Terms;
• detect or investigate fraud or security incidents;
• protect DataSheets Pro’s rights or property; or
• protect the rights, safety, or security of Customers or others.

Business transactions

Information may be disclosed as part of:

• a merger;
• acquisition;
• financing;
• reorganization;
• bankruptcy;
• sale of assets; or
• similar business transaction.

Where appropriate, information transferred in such a transaction remains subject to applicable privacy protections.

11. Sale, Sharing, and Targeted Advertising

DataSheets Pro does not sell personal information.

We also do not:

• share personal information for cross-context behavioral advertising;
• process personal information for targeted advertising as defined under applicable U.S. state privacy laws;
• use Customer Content to build advertising profiles about individuals; or
• use sensitive personal information to infer characteristics about individuals for advertising purposes.

If our practices materially change, we will update this Privacy Policy and provide any legally required notices and choices before engaging in such processing.

12. Cookies, Local Storage, and Similar Technologies

DataSheets Pro uses technologies necessary to operate the Service, such as authentication, security, session management, and account functionality.

Necessary technologies

These technologies may be used for:

• authentication;
• maintaining sessions;
• fraud prevention;
• security;
• account functionality;
• preserving necessary settings; and
• essential Service operations.

They may include cookies, local storage, or similar browser technologies. In practice these are:

• authentication cookies set by our infrastructure provider (Supabase), named with an sb- prefix, which keep you signed in;
• a ds-workspace cookie that remembers which workspace you last had open;
• a ds-cookie-consent value stored in your browser’s local storage that records your cookie choice; and
• a ds-signup-conv cookie, set for ten minutes when a new account is created so that the first page you land on can record the signup once. It carries no data and is cleared as soon as it has been read.

Advertising measurement

When you arrive from an advertisement or another tagged link, a ds-attrib cookie records the campaign labels carried in that link (such as utm_source and utm_campaign) together with the click identifier Google appends to it (gclid, gbraid or wbraid). It lets us tell which advertisement led to a signup. It contains no name, email address or other contact detail.

This cookie is stored for 90 days and, unlike the analytics cookies described below, it is set whether or not you accept in the consent banner. You can remove it at any time by clearing cookies for this site.

Analytics

We use Google Analytics 4, a web-analytics service provided by Google, to understand how visitors use our public marketing pages so we can improve them. Google Analytics sets first-party cookies (for example, _ga and _ga_*) and collects usage information such as pages viewed, approximate location, device and browser type, and referring links.

Our Google Ads account is linked to this same Google tag as a second destination, so the events described above are also used to measure which advertisements lead to signups. It is covered by the same consent choice as Google Analytics, described below: unless you accept, no advertising identifiers are sent and nothing is used to personalise advertising to you.

We also use Vercel Web Analytics, provided by Vercel Inc., our hosting provider, for aggregate page-view counts on the same public pages. It sets no cookies and identifies a visit only by a short-lived hash of the request; it receives the page viewed, referrer, device and browser type, and country. Its script in your browser does not run until you accept analytics cookies in our consent banner. Separately, our own servers report a small number of product events to it without waiting for the banner, for example that the document builder was opened or a signup form was submitted, because these are first-party counts made on our side rather than by a script in your browser. Such a report carries the page, your IP address and browser type, the channel labels from the attribution cookie described above, and the cookies your browser sent to our site (Vercel hosts the site, so it already receives these with every request); it carries no name, email address or document content.

Analytics cookies are off by default. Until you accept in our consent banner, Google Analytics sets no cookies and is sent no cookie or advertising identifier, nothing is used to personalise advertising, and the same applies if you decline. The Google tag itself does load, and in that state it reports the page viewed without cookies or advertising identifiers; as with any web request, that report still carries your IP address and browser type. Google uses it only to produce aggregate and estimated statistics that are not linked to a later visit. Accepting turns on the cookies and the measurement described above. You can change or withdraw your choice at any time using the “Cookie settings” link in the footer; withdrawing returns the tag to the cookieless state described here. We do not send Google Analytics your name, email address, account identifier, or the contents of your documents.

Google processes this information as described in its own privacy and cookie policies. We do not use third-party advertising cookies, behavioral advertising pixels, retargeting technologies, or session-replay tools.

Do Not Track and Global Privacy Control

Some browsers offer a Do Not Track (“DNT”) setting.

Because there is no universally accepted technical standard for DNT, we do not currently respond to browser DNT signals.

Where applicable law requires recognition of an opt-out preference signal, such as Global Privacy Control (“GPC”), we honor that signal as required.

13. Session Replay, Error Monitoring, and Content Protection

DataSheets Pro does not use session-replay technology inside:

• authenticated document editors;
• authenticated areas designed to display Customer Content; or
• the interactive demo document editor.

If session replay or similar usability tools are ever used on public marketing pages, we use them only with appropriate masking, exclusion, or consent controls.

Error-monitoring and diagnostic systems are configured to avoid unnecessary capture of Customer Content and to limit or scrub sensitive request data, document payloads, and user-entered content where reasonably possible.

14. Image and File Metadata

Uploaded image files may contain embedded metadata such as:

• camera information;
• timestamps;
• device details;
• location information; or
• GPS coordinates.

Raster images

Raster images processed through the standard DataSheets Pro image-processing pipeline are re-encoded and embedded metadata such as EXIF and GPS information is removed before the processed image is retained for normal Service use.

Temporary source files used during image processing are deleted when processing completes.

SVG files

SVG files are validated and sanitized rather than processed in the same manner as raster images.

We remove or disable unsupported active or scriptable content and other elements that are not required for the supported use of the SVG within the Service.

15. Data Retention, Deletion, and Account Closure

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, comply with legal obligations, resolve disputes, maintain security, and enforce our agreements.

Retention depends on the type of information and why we process it.

Account and profile information

We generally retain account information while the account is active and for a limited period afterward where necessary for account administration, legal obligations, fraud prevention, dispute resolution, security, or compliance.

Account deletion

You can delete your DataSheets Pro account yourself from Account → Security in the app. Deletion takes effect immediately and is irreversible: your account and the Customer Content it owns are permanently removed. You can also contact legal@datasheetspro.com if you need help.

Deleting your individual account does not automatically delete Customer Content owned or controlled by an organization workspace.

If your account is the sole owner or administrator of a workspace, we may require the disposition of that workspace to be resolved before completing account deletion.

This may include designating another authorized owner where applicable or confirming termination of the workspace.

If the workspace is terminated, the workspace termination and retention process described below applies.

Active Customer Content

Customer Content is generally retained while the applicable workspace remains active.

A temporary billing delinquency does not, by itself, cause Customer Content to be deleted.

Downgrades and content above plan limits

If a Customer downgrades to a plan whose document, storage, version-history, or other limits are below the Customer’s existing usage, existing Customer Content is not deleted solely because of the downgrade.

Content or functionality exceeding the new plan’s limits may become:

• read-only;
• inaccessible for editing;
• restricted from creating additional content;
• subject to reduced feature access; or
• otherwise limited until usage is reduced or the Customer upgrades.

Where supported, Customers may continue to access or export existing documents in accordance with the applicable plan, security restrictions, and Terms of Service.

User-initiated deletion and Trash

When an Authorized User deletes supported Customer Content, such as a document or uploaded asset, the content may first move to a recoverable Trash or soft-deleted state.

Unless otherwise stated in the Service, supported deleted content remains recoverable for 30 days.

After the 30-day recovery period expires, the content may be permanently removed from active systems.

Document-deletion cascade

When a document is permanently deleted, Customer Content uniquely associated with that document may also be deleted, including:

• document versions;
• document-specific metadata; and
• generated export files.

Any active download links to a deleted document’s exports are invalidated before the underlying recoverable copy is permanently removed.

Shared assets that remain in use elsewhere, such as workspace-level brand assets or logos, are not deleted solely because one document referencing them is deleted.

Exported files

Files you export through the Service (such as PDF or image files) are treated as Customer Content.

They remain subject to applicable workspace permissions, retention practices, and document-deletion rules.

Workspace termination

When a workspace terminates or loses access to the Service, Customer Content may be permanently deleted from active systems beginning 30 days after termination or loss of access, unless a different period applies under an order form, plan, legal requirement, or other applicable agreement.

Version history

Each plan retains a limited number of saved versions per document. If a Customer downgrades to a plan with a lower limit, versions beyond that limit are deleted the next time the document is saved and are not recoverable by later upgrading.

Backups

Customer Content and other information may remain for a limited additional period in backups and disaster-recovery systems before being overwritten or deleted through ordinary backup-rotation processes.

Billing, tax, and transaction records

We retain billing and transaction records for periods required by applicable:

• tax;
• accounting;
• financial;
• legal; and
• compliance obligations.

Security and system logs

We retain logs for periods reasonably necessary to:

• secure the Service;
• investigate incidents;
• diagnose problems;
• prevent fraud; and
• maintain operational records.

Support communications

Support records may be retained for a reasonable period to:

• provide continuing support;
• understand prior issues;
• improve support services;
• resolve disputes; and
• maintain business records.

Marketing preferences

We may retain information about marketing preferences, including unsubscribe requests, for as long as necessary to honor those choices.

Legal and compliance records

We may retain records of:

• contractual acceptance;
• privacy requests;
• consent;
• legal notices;
• disputes; and
• compliance activity

for as long as reasonably necessary to document our obligations and protect legal rights.

When information is no longer required, we take reasonable steps to delete, anonymize, or securely dispose of it.

16. Security

We use administrative, technical, and organizational safeguards designed to protect personal information and Customer Content.

Depending on the nature of the information and Service functionality, safeguards may include:

• encryption in transit;
• encryption at rest;
• access controls;
• authentication controls;
• role-based permissions;
• logging and monitoring;
• secure infrastructure;
• backup and recovery measures;
• data-minimization practices;
• image-metadata removal;
• file sanitization;
• diagnostic-data scrubbing;
• vendor security requirements; and
• internal controls designed to limit unnecessary access.

No transmission, storage system, or security measure can be guaranteed to be completely secure.

Customers are responsible for:

• protecting account credentials;
• assigning appropriate workspace permissions;
• managing Authorized Users;
• using appropriate security controls; and
• determining whether the Service is appropriate for the types of information they choose to process.

Security incidents

If we become aware of a security incident involving Customer Personal Data, we will notify affected Customers without undue delay where required by applicable law or an applicable Data Processing Addendum.

Where direct notification to affected individuals is legally required of DataSheets Pro, we will provide that notification within the period required by applicable law.

Additional incident-response obligations may be described in a Data Processing Addendum available to business Customers upon request or where required by applicable law.

17. International Data Transfers

DataSheets Pro is based in the United States.

Personal information may be processed in the United States or other countries where DataSheets Pro or our service providers operate.

These countries may have privacy laws that differ from those in your jurisdiction.

Where applicable law requires safeguards for international transfers, we use one or more legally recognized transfer mechanisms as appropriate, which may include:

• adequacy decisions;
• the European Commission’s Standard Contractual Clauses;
• UK-approved international data-transfer mechanisms;
• contractual protections; or
• other lawful transfer mechanisms.

Where DataSheets Pro processes Customer Personal Data on behalf of a Customer, additional transfer provisions may be included in a Data Processing Addendum available to business Customers upon request or where required by applicable law.

18. Your Privacy Rights

Depending on your location and applicable law, you may have rights concerning your personal information.

These rights may include the right to:

• request access to personal information;
• request correction of inaccurate information;
• request deletion;
• obtain a portable copy of certain information;
• object to certain processing;
• restrict certain processing;
• withdraw consent where processing is based on consent;
• opt out of certain sales, sharing, or targeted advertising;
• limit certain uses of sensitive personal information where applicable;
• appeal certain privacy-request decisions; and
• lodge a complaint with an applicable privacy or data-protection authority.

These rights are subject to applicable exceptions and legal limitations.

How to submit a request

To exercise a privacy right, contact:

legal@datasheetspro.com

We may request information reasonably necessary to:

• verify your identity;
• confirm your jurisdiction;
• locate relevant information; and
• prevent fraudulent requests.

We will not discriminate against you for exercising applicable privacy rights.

Response timing

We respond to privacy requests within the time required by applicable law.

This is generally:

• within one month for requests governed by European data-protection law, subject to legally permitted extensions; and
• within 45 days for many U.S. state privacy requests, subject to legally permitted extensions.

Authorized agents

Where applicable law permits, you may authorize another person to submit a request on your behalf.

We may require evidence that the agent is authorized to act for you and may separately verify your identity.

Customer-controlled information

If your request concerns Customer Personal Data controlled by a DataSheets Pro Customer, we may direct you to the applicable Customer.

We will assist the Customer as required by applicable law and our agreements.

19. U.S. State Privacy Disclosures

Residents of certain U.S. states may have additional privacy rights under applicable state law.

Depending on the law that applies, these may include rights to:

• know or access categories and specific pieces of personal information;
• understand categories of sources;
• understand purposes of processing;
• know categories of third parties to whom information is disclosed;
• correct inaccurate information;
• delete personal information;
• obtain portable information;
• opt out of sale;
• opt out of sharing or targeted advertising;
• opt out of certain profiling;
• limit certain uses of sensitive personal information;
• use an authorized agent; and
• appeal certain decisions.

Sale and targeted advertising

We do not sell personal information.

We do not share personal information for cross-context behavioral advertising or process personal information for targeted advertising as those terms are defined under applicable state privacy laws.

Sensitive personal information

We do not use sensitive personal information to infer characteristics about individuals for advertising purposes.

Appeals

If applicable law gives you the right to appeal our response to a privacy request, you may submit an appeal using the same privacy contact identified in this Policy and state that you are appealing a prior decision.

20. EEA, Switzerland, and United Kingdom Privacy Disclosures

If you are located in the European Economic Area, Switzerland, or the United Kingdom, you may have additional rights under applicable data-protection law.

Depending on the circumstances, these may include:

• access;
• rectification;
• erasure;
• restriction;
• objection;
• data portability;
• withdrawal of consent; and
• the right to complain to a supervisory authority.

Where we rely on legitimate interests, you may have a right to object to processing based on those interests in certain circumstances.

Where we rely on consent, withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.

Complaints

You may have the right to lodge a complaint with the data-protection authority responsible for your jurisdiction.

We encourage you to contact us first so we can attempt to address your concern.

Automated decision-making

DataSheets Pro does not use personal information to make solely automated decisions about individuals that produce legal or similarly significant effects unless we provide separate notice describing that processing and applicable rights.

AI-assisted document features, mapping, extraction, and content-generation tools do not by themselves constitute such automated decision-making.

EU or UK representative

If DataSheets Pro becomes legally required to appoint an EU representative, UK representative, or Data Protection Officer, applicable contact information will be made available in this Privacy Policy or another appropriate privacy notice.

21. Children

The Service is intended for business and professional users and is not intended for individuals under 18 years of age to create or operate accounts.

We do not knowingly collect personal information directly from children for the purpose of establishing DataSheets Pro user accounts.

If we learn that an individual under 18 has created an account in violation of our Terms, we may take steps to close the account and delete associated personal information as appropriate.

Customer Content may contain information about individuals under 18 where a business Customer has a lawful and appropriate reason to process that information. In those circumstances, the Customer is responsible for determining the lawful basis and appropriateness of the processing.

If you believe a child has improperly provided personal information directly to DataSheets Pro, contact us at legal@datasheetspro.com.

22. Sensitive Personal Information

DataSheets Pro is designed primarily for product and business documentation and is not intended to function as a repository for highly sensitive personal information unless a particular feature expressly supports such use.

Unless necessary for a legitimate and supported business purpose, Customers should avoid uploading information such as:

• Social Security numbers or equivalent national identifiers;
• passport or driver’s-license numbers;
• financial-account passwords or credentials;
• payment-card numbers;
• medical records about individuals;
• genetic information;
• biometric identifiers;
• precise personal geolocation;
• personal authentication secrets; or
• other highly sensitive information unrelated to the intended use of the Service.

Customers are responsible for determining whether they have appropriate authority, safeguards, and legal bases before placing sensitive personal information in Customer Content.

DataSheets Pro does not intentionally collect biometric identifiers for identification or authentication unless we expressly introduce a feature requiring such processing and provide legally required disclosures or consents.

23. Subprocessors

DataSheets Pro uses service providers and subprocessors to operate the Service.

Our current material subprocessors, their purposes, and related information are available on our Subprocessor List.

We update the list as our infrastructure and Service evolve.

Where required by an applicable agreement or privacy law, we provide advance notice of intended additions or replacements as described in Section 10.

24. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to the Service;
• changes to our data practices;
• new features;
• new service providers;
• changes in law; or
• other business developments.

When we make material changes, we will update the Last Updated date and, where appropriate or required by law, provide additional notice through the Service or by email.

If a change requires consent under applicable law, we will obtain consent before applying the change where required.

Prior versions

We maintain prior versions of this Privacy Policy so material changes can be reviewed over time.

Archived versions may be made available through our legal pages or upon request.

25. Contact Us

For questions about this Privacy Policy, our privacy practices, or applicable privacy rights, contact:

DataSheets Pro LLC
Privacy Email: legal@datasheetspro.com
Mailing Address: 36 North Cass Ave, Unit #5102, Westmont, IL 60559

If your request concerns personal information contained in a workspace operated by one of our Customers, we may direct you to that Customer as described above.